I am trying to use Geodesic and following the cold start documentation (https://docs.cloudposse.com/reference-architectures/cold-start/) Things were going ok until I got to the

PROVISION IAM PROJECT TO CREATE ROOT IAM ROLE

section. I believe that maybe the

cd

command here is supposed to be

cd root-iam

because the module identified is not used in the

iam

directory and the plan identifies nothing to perform. So I moved over to the

root-iam

directory and performed the same steps but when I try to apply I only get

403

errors.

* module.organization_access_group_root.aws_iam_group.readonly: 1 error(s) occurred:

* aws_iam_group.readonly: Error creating IAM Group instinct-root-readonly: InvalidClientTokenId: The security token included in the request is invalid
	status code: 403, request id: b06f7a1d-bd11-49d9-9fd9-b0b69dfebd02
....
....

Does anyone have ideas what might be going on here? I have tried all combinations of using the actual root AWS account, the admin account setup at the top of that page, and have disabled MFA in case it was getting in the way. I have been stuck for way to long on this step and can’t seem to find anything in the archives (though i could be missing something)

Looks like your token might have expired?

I thought so as well. I fiddled with reauthenticating, removing the credentials from

aws-vault

and replacing them with no luck. I am not 100% clear on exactly how the token is acquired so I may be missing a step to try to re-authenticate. I was able to perform the earlier step and make the S3 bucket and setup the DynamoDB for the TF backend.